RHSA-2026:82151CriticalCVSS 10.0

Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images

Published
October 13, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (48)

CVE-2026-92941 →CVE-2026-92951 →CVE-2026-47683 →CVE-2026-82417 →CVE-2026-92956 →CVE-2026-19534 →CVE-2026-59893 →CVE-2026-71491 →CVE-2026-75975 →CVE-2026-84292 →CVE-2026-84375 →CVE-2026-92935 →CVE-2026-92944 →CVE-2026-75899 →CVE-2026-92937 →CVE-2026-92938 →CVE-2026-92946 →CVE-2026-92953 →CVE-2026-92954 →CVE-2026-92959 →CVE-2026-92960 →CVE-2026-13697 →CVE-2026-47686 →CVE-2026-47698 →CVE-2026-93604 →CVE-2026-93605 →CVE-2026-93606 →CVE-2026-55553 →CVE-2026-75931 →CVE-2026-77037 →CVE-2026-82333 →CVE-2026-92942 →CVE-2026-92947 →CVE-2026-92950 →CVE-2026-92958 →CVE-2026-84394 →CVE-2026-84961 →CVE-2026-92940 →CVE-2026-92955 →CVE-2026-92957 →CVE-2026-92961 →CVE-2026-93603 →CVE-2026-76172 →CVE-2026-92934 →CVE-2026-92939 →CVE-2026-92948 →CVE-2026-54284 →CVE-2026-88932 →

📋 Description

CVE-2026-13697 — undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-47683 — vm2: vm2: Denial of Service due to memory allocation limit bypass CVE-2026-47686 — vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE CVE-2026-47698 — vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-54284 — sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing CVE-2026-55553 — urllib: urllib: Credential leakage via cross-origin redirects CVE-2026-59893 — sqlparse: sqlparse: Denial of Service via inefficient SQL parsing CVE-2026-71491 — sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping CVE-2026-75899 — fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75931 — fast-uri: fast-uri: Host confusion via skipped IDN canonicalization CVE-2026-75975 — fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization CVE-2026-76172 — fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects CVE-2026-77037 — multer: Multer: Denial of Service via file descriptor leak on aborted uploads CVE-2026-82333 — multer: Multer: Denial of Service via oversized array index in field names CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84394 — fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies CVE-2026-84961 — undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options CVE-2026-88932 — multer: multer: Denial of Service via orphaned disk writes on aborted uploads CVE-2026-92934 — vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError CVE-2026-92935 — vm2: vm2 NodeVM Remote Code Execution via Array-Shaped Require CVE-2026-92937 — vm2: vm2 3.11.6 Remote Code Execution via Promise call/apply CVE-2026-92938 — vm2: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite CVE-2026-92939 — vm2: vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine CVE-2026-92940 — vm2: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent CVE-2026-92941 — vm2: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation CVE-2026-92942 — vm2: vm2: Denial of Service via timeout bypass in sandboxed code CVE-2026-92944 — vm2: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector CVE-2026-92946 — vm2: vm2 before 3.11.7 Remote Code Execution via require.external CVE-2026-92947 — vm2: vm2 before 3.11.7 Memory Disclosure via Buffer Pool CVE-2026-92948 — vm2: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test CVE-2026-92950 — vm2: vm2 before 3.11.7 Sandbox Escape via CLI require CVE-2026-92951 — vm2: vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver CVE-2026-92953 — vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray CVE-2026-92954 — vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise CVE-2026-92955 — vm2: vm2 before 3.11.8 Sandbox Escape via NodeVM CVE-2026-92956 — vm2: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming CVE-2026-92957 — vm2: vm2 before 3.11.7 Authentication Bypass via node: Prefix CVE-2026-92958 — vm2: vm2: Sandbox escape via denylist bypass in NodeVM CVE-2026-92959 — vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation CVE-2026-92960 — vm2: vm2 before 3.11.6 Process-wide State Exposure via os and dns CVE-2026-92961 — vm2: vm2: Denial of Service via memory exhaustion CVE-2026-93603 — vm2: vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVE-2026-93604 — vm2: vm2: Sandbox escape via crypto.setFips() function CVE-2026-93605 — vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process CVE-2026-93606 — vm2: vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

🎯 Affected products2

  • Red Hat Ansible Automation Platform 2.2
  • registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:8553c734145775879bdfe2befa9f2df1c22c6d7db2f2251401c3cc517a7e0394_amd64 as a component of Red Hat Ansible Automation Platform 2.2

✅ Remediation

For more about Ansible Portal Installer Bootc, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Until updates are available, restrict the processing of user-supplied URIs to trusted sources only, implement strict allowlists for destination hosts (preferably IP-based rather than hostname-based), and apply egress filtering to prevent server-initiated connections to internal networks or cloud metadata services. Workaround: There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. Workaround: Upgrade to multer 2.3.0 or later, which properly closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Workaround: Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs. Workaround: If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests. Workaround: Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line). Workaround: Until updates are available, administrators can implement the following mitigations to reduce the risk of disk exhaustion: 1. Monitor disk usage on systems running Red Hat Developer Hub or Ansible Portal and set up alerts for unusual disk consumption patterns. 2. Implement rate limiting on file upload endpoints to restrict the number of upload requests from a single IP address or user account within a given time period. 3. If authentication is not strictly required for file upload endpoints, enable authentication to reduce the attack surface to authenticated users only. 4. Periodically clean up orphaned temporary files in multer's storage directory. The default upload directory is typically in the system temp folder or a configured uploads directory. 5. Set disk quota limits for the user account or partition used by the application to prevent complete disk exhaustion from affecting the entire system. For production environments, apply updates as they become available from Red Hat product teams. Workaround: Until the fix is applied, do not expose non-strict host functions to the sandbox. Only inject strict-mode or ES-module functions so a missing this cannot resolve to the host global. Workaround: This issue is fixed in vm2 version 3.12.1. Red Hat will provide updated versions of Developer Hub and Ansible Portal that include the fixed library version. Until updates are available, administrators can reduce the risk of sandbox escape attacks by implementing the following mitigations: 1. Review vm2 sandbox configurations to determine if the 'crypto' builtin is explicitly allowlisted for untrusted guest code (require.builtin: ['crypto']). If crypto access is not required for guest code functionality, remove it from the allowlist. 2. Restrict the sources from which untrusted code is accepted. Only allow code execution from authenticated, trusted users or verified sources. Implement code review processes for any scripts or plugins before they are executed in vm2 sandboxes. 3. Monitor for unexpected changes to the Node.js process FIPS mode. Log calls to crypto.getFips() before and after guest code execution to detect unauthorized FIPS mode modifications. 4. In FIPS-required environments, consider running vm2 sandboxes in separate isolated processes rather than in the same process as critical application components. Process-level isolation provides an additional security boundary beyond vm2's VM isolation. 5. Implement additional access controls and audit logging for any systems that accept and execute user-provided code, scripts, or plugins. 6. Upgrade to vm2 3.12.1 or later as soon as updated packages are available from Red Hat. Workaround: Until the fix is applied, do not configure NodeVM with require.builtin set to ['*'], a star-minus subtract list, or an explicit child_process allow. Use a tight builtin allowlist that excludes child_process. Workaround: Until the fix is applied, do not expose host functions that return host-realm Promise objects to VM/NodeVM. Return only serialized primitives, or keep host work fully outside the sandbox.

🔗 References (52)